Vulnerability · Published Aug 21, 2026 · Assigned by WPScan
CVE-2026-19435Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
Low 2.7
In plain English
A low-severity information exposure in Duplicate Post from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.3%top 75.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Duplicate Post | 0 – before 1.5.6 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/483051a0-28da-4141-a197-83bda56a29d4/ exploit, vdb-entry, technical-description